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Where are Phone Numbers seen in DNI' 





Phone Numbers are located in MANY parts 
of DNI traffic 



“Contact Us” parts of web pages 
Signature Lines 
Address Books 

“Leaked” as METADATA in Mobile HTTP traffic 

Collected as converged data from 
GPRS/CDMA/WLL traffic 

Collected in signaling of VOIP traffic 
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Looking inside the body of content, the 
Phone Number Extractor Looks for: 

Telephony-related terms in the body of traffic and 
parses out any digits after that 

Ex: “Tel:” or “Mobile” or “Fax” or “ 

Note that all punctuation is removed. 

i.e. (92) 928.555-555 becomes 92928555555 
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Phone Numbers on Websites 





Many times phone numbers are in the body 



of a website 



“Contact-Us” 

Craigslist-like websites listing items for sale 
Forums, etc... 

Traffic can be TO or FROM Port 80 




From Port 3434 

(client) “Reply: Contact Me 



► 




00-91-123456” 

POST to the Web server 



To Port 3434* 
(client) 



<4 



“For more information, contact 

HTTP Response 



31 



To Port 80 
(Server) 



From Port 80 
(server) 



L 



\ 
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Normalization problems 



When a phone number is in the “body” of traf 
like a signature block or a “contact us” line on a 
webpage, it doesn’t have to be normalized. 




XKS will extract the number exactly how it 
appears (minus punctuation and leading 0’s) 
which can create problems. 



Look what happens to the ‘0’ happen here: 
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Phone Numbers on Websites 
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Search: Phone Number Extractor 



Query Name: 



IRGC 



Justification: 



Iranian Phone numbers for IRGC 



Recent Just ifical 



Additional Justification: 



Query 



Miranda Number 



Datetime 



3 Days 


V 


Start: 


2005-10-03 


n 




00:00 


A. 

V 



Stop 



Phone Number: 



Port: 




80 




From "4 



Port: 



To 



Country: 



v 



From 4 



Country: 



IR 



V 



To 



TOPSECRETWCOMINT7/RELTO USA, AUS, CAN, GBR, NZL 















>10 01 101 tuul 
1 00 1 I ooi toot 

t c m loot 



TOP SECRET//COMINT//RELTO USA, AUS, CAN, GBR, NZL 




O I 01 Ol I 

>101 jlOOOl 
o 01 IOTOIO 

3 101 



Phone Number 





Highlights Number Type 



W 



telephone 



Fm Countr Fm Port To Country To Port 

US SO IR 4179 




Erter ted to search' 



PII MMX- Ram 196 - Hard 3 DGB-CDRom ^Ijh q i> j\j \ Gj ^jGLi tfljlj 
L UU pJjjLLij Windows XPIBM 210000 X. ^1 j oi-Lj 



I 



: 6 - LlJ ! o 1 



AY /1/VI 



Farsi: “TEL” 



Dell 500 aujl JUH )U JU U uuJI 
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Phone Numbers in SIG Blocks 



- 

Signature lines are SELECTOR-RICH 
environments (Emails, phones, names 
titles, etc..) 

Many SIG blocks have extraneous 
characters/numbers 

XKS ignores dashes, parenthesis, etc.. 

XKS only parses out the numbers after 
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Phone Numbers in SIG Blocks 
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Search: Phone Number Extractor 



Query Name 




Justification 



Query 



dditional Justification: 



possible Lebanese hizb 
Procurement front company 



Recent Just ifi cat io 



v 



Miranda Number: 



Datetime: 



3 Days w 


Start: 


2009-10-03 


h 


i 


00:00 


A 

V 



Stop : 



Phone Number: 
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Phone Numbers in SIG Blocks 



State ID 



Phone Number 



Highlights Number Type Fm Countr Fm Port To Country 



OS] 



1 640 



fax 



us 



30 



LB 



otation 



From IP 



From Port To Port Protocol 



JQQQQMQQQQ 



209 



l(S United States) 



(j. Lebanon) 



80 



28678 TCP 



nts (11) Meta (il) 



Enter text to search 



aeauct rrom tne pricev 
related to works alread 

self 

0 I would like t 

m2 I need to buy and h 



to De suDinitted by contractor tailing into consideration any aoo 
executed + submit separately offer for marble to be supplied by ; 



change the ceramic tiles for the two other bathrooms. What is th< 
much you will deduct from the price? Under assessment by contrac 
into consideration any [abortive works related to works already executed. 

0 Master Bedroom bathroom, I would like to make it bigger and to cahnge the locati* 

of the Toilet Seat + have doubel sinks. 

As at this stage all Jend-user's requests are clear,. we kindly ask you to give the releva: 
maximum within a coup Jr e of days . 

Thanks and Best regards 



Development Manager 









Fax : 



You can view our new projects on 
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HTTP GET Requests contain many 
“leaked” phone numbers from the providers 

GPRS activity commonly seen with DNR 
selectors 
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Phone Numbers in HTTP GE"'s 



#101 GIuDut 
® Of totlJic 



Search: Phone Number Extractor 



Query Name 



Justification 



Additional Justification; 




Start: 



2009 - 10-03 





00:00 








From Y 






80 




To 



From 4 

















) ID 01 IWI 
1001 I 001 1C 

„ i 



in 






o 



1 Ini'. 
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Phone Numbers in HTTP GE" 's 







MW 






Phone Number 



Highlights Number Type 



Results 




telephone 



4-.I-I I rt l-i I ^ i- 1 , l-'t. 



Fm Countr Fm Port To Country 

IR 57375 US 



To Port 



r“7CVT c 



so 



0/1 






Enter text to search 



AUTO FORMATTER: app_id = unknown/port80/http_www Viewer= ASCII format! 



2.2.1 Profile/MII P-2 . 0 Configuration/ CLDC-1. 1 

accept- applicatic n: K-wap- application: wnl. ua f K-wap-application:mms. ua 
Content-length: [ 

Xi^:^X p ZAjJL? ' wapTj m t turancelL ir_ (Ngkia_ Gat eway 4 . 1/ CD2 0/ 4.1. 113 ) 
K-Network-info : GPRS, rHHHfimsecured I 

^Wokia^msisdniJB^BBBB ! 

X-Nokia-CONNECTIOW_MODE : TCP 
X-Nokia-BEARER: GPRS 
X-Nokia-GATEWAY_ID: NWG/4. 1/ Build 113 
x-nokia. wia. accept . original : application/xhtml+xrnl, text/html, application/ vnd. w 
Connection: close 
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Phone Numbers in HTTP POS""s 





Many times a phone number is submitted in 
an HTTP “POST” session 



If a person fills in a form or replies to an email, 
the information in the body will be collected 
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Phone Numbers in HTTP — ■ 



I 10! eluDD 

0 Q| |0||jJU 



Fields T Advanced Features T 5 hfl Hidden Search Fields Clear Search Values Reload Last Search Values 



Search: Phone Number Extractor 



Query 



Query Name: 



Justification: 



Additional Justification: 



Miranda Number: 




Date time: 



2 Weeks 




Start: 


2009-09-24 


□ 




00:00 


A 

■a- 


Stop: 



2( 



Phone Number: 



Port: 



Port: 



Country: 







r i 



1 



i 

















) 10 01 
1001 i 






4 
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Phone Numbers in HTTP POSTs 






Phone Number 



Highlights 


Number Type 


Fm Countr Fm Port 


To Country 


To Port 


mobile 


IR 3511 US 


80 



From IP 


To IP 


From Port 


To Port 


Protocol 



Length 



Iran) 



United States) 



3511 



TCP 



13476 



r i eniis (L) 



Enter text to search 



POST /mail / 7ui=2&ik=3 6737 lb Id 8 kalt=xn3 j3 8ni>g jyf ueofs jzpxq6ubnbomkview=upkact=sd& jsid=plre vt7| 
Host : mail . google . com 

User-Agent: Mozilla/5.0 (Windows]; U; Windows rJr 5.1; en-US; rv: 1.9. 1.3) Gecko/200 90824 Firef| 
Accept : text/ html, application/ xhjtml + xml r application/ xml ; q=0 . 9, */ * ; q=0 . 0 
Accept-Language : fa ' 1 1 

Accept -Encoding: gzip r deflate I 
Accept -Charset : ISO-8 85 9-1, utf-8|; q=0 . 7, * ; q=0 . 7 
Keep-Alive: 300 | 

Connection: keep-alive | 

Content -Type : application/ x-www-.form.-url encoded ; charsei 
Refere r : http: / /mail . google . com/mail/ ?ui=2 kview=j ssnam« 

Cookie: S = gma i 1 = D 8 - U_b h 5 V JXM x nq pfe v U unA : gm p r o xy = Q5 n_X d 7 qeiw-ytoiaj aynjraA ; GX = DQAAAH o AAAB cX 4lyR 

Pragma: no-cache 

Cache-Control: no-cache | 



No Phone 
Number in 
the POST 
Metadata 



VitiMKYU . en. &am= J Hln0yYGL2 



&cc=fibcc=&subject=Re %3A%2 






r i 



i 



i 
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Phone Numbers in HTTP POSTs 





Phone Number Highlights 



Number Type 
mobile 



Fm Countr Fm Port 



To Country To Port S 

US 80 C 




I 



yuick Clicks 

1 1 Session 

=1 Attach merits 
3#|web 

— 

1 .2_Junkriown_152,x-www-form-L 

■ "SI ■?" onknumT 

3 ? text 

? document_body.enriail_0.txt 

-,! Find opposite side of session 
92 

8 0 

3 Find traffic on 

209 ■■■■■ 



unknown 152 



"he phone number was in 
the body of the POST (i.e. a 
reply to an email) 



l\ text 



1.TTE 



Virus scan results 



Jsinq\HTML formatter 




009 / 10/3 

/Thanks Dear Hubert, 

I nyed to call from Here, But is very Difficult to Call UK from Here. 

Coukl pis. Give my Contact, or Skpye to Him to Call me urgently: 

r -ftkrper 
Mobile? 
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Mobile DNI 






Mobile DNI Collect comes in two main types: 




Convergence of DNR & DNI selectors! 
Mostly from F6 collection 



Most cases, needs to be "near” the infrastructure 



Gateway 





Looks like regular DNI but with “hints” that the 
source is a cell phone 

Collection could be F6, FORNSAT. SSO. FISA 
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Mobile DNI: HTTP Activity 



HTTP activity comes in two types: 




“Hints” of DNR origins 
Public (proxy) IP addresses 



website.com Server 



Convergence of DNR & DNI selectors! 
Usually private IP addresses 




p p p o 



a a n a 
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USER A 
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Phone Numbers From Converged Collection 





ACTIVITi r USER E 

<yaho :■> se en with. machine ID 



COOKIE 



ACTIVE USER 



ACTIVE USER 









<yahoo> 202. 




Datetime 

2009-10-05 17:12:50 



Datetime End 

i-' 10-05 17:12:50 



Phone Number 



2009-10-05 17:13:40 2000-10-05 17:13:55 



■■ ■■ ' r - d ^ r- d-r 



2009-10-05 17:13:11 

16:07 
15:10 



Results 



10 05 17 
si 0-05 17 
2009-10-05 17 
2O09-1O-O5 17 



16:17 



1 3:2$ 
19:11 



10-05 17:13:11 
10-05 17:16:07 
10 05 17:15:18 
10 05 17:16:17 
10-05 17:13:28 
10-05 17:13:2$ 
10-05 17:19:1$ 




Number Type 


Country Code 


Area 


imsi 


pk 


M#l}ilink: 


imsi 


pk 


M$l}ilink 


imsi 


pk 


M<>l>iliiik: 


imsi 


pk 


Mol>ilink: 


imsi 


pk 


Moliliiii 


imsi 


pk 


Moliilink 


imsi 


ilk 


Mo-Mliht 


imsi 


pk 


MoJviliifet 


imsi 


pk 


M'>l>iliiik 
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